The vulnerabilities, tracked as CVE-2026-59346 and CVE-2026-59347, affect VMware Workstation and VMware Fusion versions 25H2 and 26H1. Broadcom has rated the advisory, VMSA-2026-0007, Critical, with CVSSv3 scores ranging from 8.1 to 9.3. The company has released version 26H1u1 to address both flaws, with no workaround available.
For organizations using virtualization for development, testing, security research or sensitive workloads, the disclosure is a reminder that the virtual machine boundary is itself a security boundary and one that attackers may try to cross.
Two vulnerabilities, one serious virtualization risk
The first vulnerability, CVE-2026-59346, is an integer-overflow flaw affecting the VMXNET3 virtual network adapter in VMware Workstation and Fusion.
Broadcom has assigned it a maximum CVSSv3 score of 9.3, placing it in the Critical range.
The attack scenario is important. An attacker must already have local administrative privileges inside a virtual machine, and the affected VM must use a VMXNET3 virtual network adapter. If those conditions are met, Broadcom says the attacker may exploit the vulnerability to execute code on the host operating system.
In practical terms, this is a potential guest-to-host compromise. The attacker starts with control of the virtual machine but may be able to break through the isolation layer and execute code on the physical or host system running VMware Workstation or Fusion.
The second vulnerability, CVE-2026-59347, is a stack-based buffer overflow in the HGFS component.
HGFS, or Host Guest File Sharing, is designed to facilitate file sharing between the host and guest environments. Broadcom rates this vulnerability Important, with a maximum CVSSv3 score of 8.1. An attacker with local administrative privileges in a virtual machine could exploit the issue to execute code as the VMX process running on the host.
Although the two vulnerabilities have different technical causes, their common theme is what makes this advisory significant: code execution can potentially move from the guest environment into the host environment.
No workaround means patching is the answer
Broadcom says there are no workarounds for either CVE.
The affected versions listed in the advisory are:
- VMware Workstation 25H2
- VMware Workstation 26H1
- VMware Fusion 25H2
- VMware Fusion 26H1
The fixed release is 26H1u1 for both Workstation and Fusion.
Broadcom’s release information confirms that VMware Workstation and Fusion 26H1 were introduced earlier in 2026 as the latest generation of the desktop hypervisors, making 26H1u1 the security update organizations should now prioritize.
Security teams should therefore avoid treating this as an advisory that can simply be monitored for future developments. Where affected installations exist, upgrading to the fixed release is the appropriate remediation.
The attack does not begin remotely but the impact can be serious
One detail should not be lost in the headline.
These vulnerabilities are not described by Broadcom as unauthenticated remote attacks against an exposed VMware service. The documented attack vectors require the malicious actor to have local administrative privileges inside the affected virtual machine.
That significantly narrows the initial attack path compared with a remotely exploitable vulnerability.
But it does not eliminate the risk.
An attacker who has already compromised a developer workstation, security-testing VM, insider account or another virtualized environment could potentially use these vulnerabilities to cross the boundary separating the guest from the host.
That distinction matters because virtualization is often trusted precisely because it creates isolation. If that isolation can be bypassed, a compromise that might otherwise remain confined to a single VM can become a host-level security incident.
For organizations running multiple virtual machines on a workstation or system, host compromise can also expose other workloads, credentials, files and development environments connected to that host.
Why VMXNET3 deserves particular attention
The 9.3-rated vulnerability specifically involves VMXNET3, VMware’s virtual network adapter.
Security teams should therefore include the virtual hardware configuration in their vulnerability assessment rather than simply searching for VMware Workstation installations.
Knowing that VMware Workstation is installed is not enough. Teams should establish:
- Which version is installed.
- Whether the installation is Workstation or Fusion.
- Which virtual machines are running on the affected version.
- Whether those VMs use VMXNET3.
- Which users have administrative privileges inside those VMs.
- Whether the host contains sensitive corporate data or credentials.
This kind of asset-level visibility becomes particularly important in environments where virtualization is used by developers, engineers, penetration testers and security teams outside the traditional IT infrastructure inventory.
VMware vulnerabilities remain a recurring security concern
Today’s advisory is also arriving in a period of increased attention on VMware security.
In July, Broadcom published VMSA-2026-0006 addressing multiple vulnerabilities affecting VMware ESX, vCenter, Workstation and Fusion. One of those vulnerabilities, CVE-2026-47876, also involved the VMXNET3 virtual network adapter and was rated 9.3.
CyberCory previously reported on those VMware vulnerabilities and the subsequent exploitation activity surrounding affected vCenter environments. The developments demonstrate why organizations should treat the virtualization layer as part of their core security infrastructure rather than as simply another software category.
Read our previous coverage: VMware Under Siege: Critical vCenter and ESXi Flaws Demand Immediate Patching.
We have also covered a separate VMware Fusion privilege-escalation vulnerability earlier this year, highlighting the continuing security attention surrounding desktop virtualization platforms.
What security teams should do now
Security teams should treat VMSA-2026-0007 as a high-priority vulnerability-management task.
1. Identify every affected installation
Search endpoint, software-management and asset-inventory systems for VMware Workstation and VMware Fusion.
Do not assume corporate IT inventories capture every installation. Developer machines, laboratories, security-testing systems and engineering workstations can easily fall outside conventional infrastructure inventories.
2. Check the exact VMware version
Determine whether systems are running 25H2 or 26H1.
Affected installations should be scheduled for the upgrade to 26H1u1.
3. Prioritize systems using VMXNET3
For CVE-2026-59346, determine which virtual machines use the VMXNET3 adapter.
These systems deserve particular attention because the vulnerability specifically affects that virtual networking component.
4. Upgrade to 26H1u1
Apply the vendor-provided security update for VMware Workstation and Fusion.
Broadcom lists 26H1u1 as the fixed version for both products.
5. Do not rely on a workaround
Broadcom lists no workaround for either vulnerability.
If an affected installation cannot immediately be patched, security teams should escalate the risk, restrict its use and consider temporarily taking particularly sensitive systems out of service until remediation is possible.
6. Review administrative privileges inside VMs
Because the documented attack vectors require local administrative privileges in the guest, reducing unnecessary administrator access can make exploitation more difficult.
Apply least-privilege principles and review privileged accounts inside development and testing VMs.
7. Investigate recently compromised VMs
If a virtual machine has already shown signs of malware infection, credential theft or unauthorized administrative activity, treat it as a potential starting point for exploitation.
Patching the VMware host alone does not resolve an existing compromise.
8. Hunt for unusual host-level activity
Monitor the host for suspicious processes, unexpected child processes, unauthorized file modifications, unusual network connections and other behavior inconsistent with normal VMware operations.
Particular attention should be paid to activity appearing shortly after an attacker gained administrative access to a guest VM.
9. Isolate high-risk virtualization environments
Where practical, separate sensitive development, research and testing environments from critical corporate systems.
Network segmentation and strong access controls will not fix these vulnerabilities, but they can reduce the potential blast radius if a host is compromised.
10. Add virtualization to the critical patching process
VMware Workstation and Fusion should not be treated as ordinary desktop applications when they host sensitive workloads.
Include desktop hypervisors in vulnerability-management programs, patch SLAs, endpoint monitoring, incident-response plans and security assessments.
What this means for organizations in the Middle East and Africa
The advisory has global relevance, including across the Middle East and Africa.
VMware-based virtualization is commonly used across technology companies, financial institutions, universities, government environments, laboratories and engineering organizations. Development teams and cybersecurity professionals also frequently use desktop hypervisors to create isolated environments for testing applications, malware and security tools.
That makes visibility especially important.
An enterprise may have a well-managed central VMware infrastructure while simultaneously having dozens or hundreds of Workstation or Fusion installations distributed across developer and engineering endpoints.
Those installations can become overlooked security boundaries.
For organizations already strengthening their cybersecurity, vulnerability management and endpoint defenses, this advisory is another reason to include virtualization software in routine security assessments, Saintynet Cybersecurity.
Security and IT professionals can also strengthen their teams through structured cybersecurity training and awareness programs covering vulnerability management, incident response and secure infrastructure practices, Saintynet Cybersecurity Training.
The bigger lesson: the VM is not a security guarantee
Virtualization provides powerful isolation, but isolation is not the same thing as immunity.
A compromised guest remains dangerous when vulnerabilities in the hypervisor or virtualization components allow an attacker to interact with the host.
That is why today’s VMware advisory deserves attention even though exploitation requires local administrative privileges inside the guest.
Attackers rarely need to start with the most powerful position. A compromised endpoint, stolen account or infected development VM can provide the foothold. From there, weaknesses in the virtualization layer can potentially turn a contained compromise into something much larger.
For security teams, the lesson is straightforward: the hypervisor and desktop virtualization stack are part of the security boundary and must be patched accordingly.
Conclusion
Broadcom’s VMSA-2026-0007 addresses two vulnerabilities in VMware Workstation and Fusion that can potentially allow attackers with local administrative privileges inside a virtual machine to execute code on the host.
CVE-2026-59346 carries the highest risk, with a CVSSv3 score of 9.3, and affects the VMXNET3 virtual network adapter. CVE-2026-59347, rated 8.1, affects the HGFS component. Both vulnerabilities affect VMware Workstation and Fusion 25H2 and 26H1, and Broadcom provides 26H1u1 as the fixed release. No workaround is available.
There is no evidence in Broadcom’s September 3 advisory indicating that these vulnerabilities are being exploited in the wild. Nevertheless, organizations should not wait for exploitation reports before acting.
For security teams, the priority is clear: identify affected installations, assess VM configurations and privileges, investigate suspicious environments, and upgrade to 26H1u1.
In virtualization security, the strongest isolation is only as good as the software enforcing it.
